feat(api): allow CROS
fix(model): show category for lookup